v0.4.1

Security fix: with ORIGIN_URL set, a path starting with // could make the Worker fetch another host. Update if you use ORIGIN_URL. Also fails open on verdict values a header cannot carry.

v0.4.0

Follows the account's edge mode from the API, and makes a single edge check when SITE_ID is not set.